USB_Registry_Activity on SCSP : Symantec CSP, HIDS

Experts Exchange

	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

USB_Registry_Activity on SCSP

Asked by MMKPN in Intrusion Detection Systems (IDS), Windows Network Security, Microsoft Operating Systems, Computer Hardware, Miscellaneous Security

Tags: Symantec CSP, HIDS

I am daily getting "USB_Registry_Activity" from HIDS for a device daily at same time, but no USB is connected to the server and no scheduled services are running at that time. can you tell me what could be the problem.
RULE_NAME="USB_Registry_Connect_Activity
PROCESS_NAME="services.exe"
DESCRIPTION="Watched Registry CREATE operation on \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USB\ROOT_HUB\4&7353027&0\LogConf" OTHERINFO=""

View the Solution FREE for 30 Days

20091111-EE-VQP-92 - Hierarchy / EE_QW_3_20080625

Hall of Fame

1. richrumble31,642
2. Phateon9,820
3. DaveHowe7,210
4. kenboonejr6,150
5. jfer0x016,000
6. decoleur4,350
7. LingerLon...4,000
8. dpk_wal3,750
9. bignewf3,500
10. MikeHolcomb3,100
11. xmachine3,064
12. arnold3,000
12. Goemanne3,000
14. ikalmar2,750
15. rsivanandan2,650
16. MikeKane2,500
16. uetian17072,500
18. Mestha2,450
19. astralcom...2,200
20. breadtan2,150
21. rcflyr2,040
22. Gns2,000
22. srappaport2,000
22. ehabsalem2,000
22. gheist2,000
22. JFrederic...2,000
22. asavener2,000
22. devinnoel2,000
22. ccomley2,000
22. snoopfrogg2,000
22. TheCaped...2,000
22. Paranorm...2,000
22. JosephGl...2,000
22. deimark2,000
22. granwizz...2,000
22. TurboBorl...2,000
22. oklit2,000
22. shijupaul...2,000
22. techzter2,000
22. Matkun2,000
22. arrow_r...2,000
22. Onkelt2,000
22. 3nerds2,000
22. askb2,000
22. jake_00112,000
22. andrewallen2,000
22. jodylemoine2,000
22. digichris832,000

1. richrumble44,642
2. rsivanandan16,540
3. PowerIT10,300
4. Phateon9,820
5. DaveHowe7,960
6. clearacid7,500
7. jahboite6,880
8. What906,700
9. hfraser6,640
10. dpk_wal6,345
11. kenboonejr6,150
12. jfer0x016,000
13. billwharton5,975
14. arnold5,500
14. shakoush...5,500
16. harbor2354,850
17. decoleur4,350
18. LingerLon...4,000
19. xmachine3,964
20. batry_boy3,900
21. Kelvin_King3,500
21. bignewf3,500
23. bbao3,350
24. MikeKane3,250
25. dpiniella3,200